SOA-C02 Question 210
Single answerA company uses Amazon S3 to store sensitive customer data. As a SysOps Administrator, you are tasked with ensuring all objects stored in the bucket are encrypted at rest using AWS Key Management Service (AWS KMS). Which action should you take to meet this requirement?
- A
Enable server-side encryption with Amazon S3-managed keys (SSE-S3) on the bucket.
- B
Enable bucket default encryption with AWS KMS keys (SSE-KMS) and specify a KMS key.
- C
Use client-side encryption with an on-premises key management system and upload encrypted objects to S3.
- D
Attach an S3 bucket policy that enforces the use of SSE-S3 for all uploads.
Show answer and explanation
Correct answer: B
Explanation
To ensure encryption at rest using AWS Key Management Service (AWS KMS), you must configure the bucket to use server-side encryption with KMS keys (SSE-KMS). Enabling default bucket encryption with AWS KMS keys ensures that all objects uploaded to the bucket are automatically encrypted at rest using KMS keys, fully meeting the requirement.
- A. Incorrect.
This option enables encryption at rest but does not use AWS KMS. SSE-S3 uses S3-managed keys instead of KMS keys, so it does not meet the stated requirement.
- B. Correct.
This is the correct option. Enabling bucket default encryption with AWS KMS keys ensures all objects stored in the bucket are encrypted at rest using KMS, meeting the requirement.
- C. Incorrect.
This option uses client-side encryption and an external key management system, which does not involve AWS KMS. It does not meet the requirement to use AWS KMS for encryption at rest.
- D. Incorrect.
This option enforces server-side encryption but does not specify AWS KMS keys. SSE-S3 is not the same as SSE-KMS, so this does not meet the requirement.